Understanding Unix File Permissions: rwx, Octal, and umask

Run ls -l on any Unix or Linux system and the first column looks like line noise: -rwxr-xr-x. That string is a complete access control statement, and once you can read it, permission errors stop being guesswork. This guide breaks down what each piece means and how to set it correctly.

Three permissions, three audiences

Every file and directory grants three kinds of access:

• read (r) — view the contents of a file, or list the entries in a directory
• write (w) — change a file, or add and remove entries in a directory
• execute (x) — run a file as a program, or enter a directory

Those three permissions are assigned separately to three audiences: the user who owns the file, the group associated with it, and everyone other. That gives nine bits in total, which is exactly what the rwxr-xr-x string shows.

Reading the ls output

-rwxr-xr-x  1  alice  staff  1024  file.sh
 \__/\__/\__/
  |   |   |
  |   |   other: r-x (read, execute)
  |   group: r-x (read, execute)
  user: rwx (read, write, execute)

The very first character is the file type, not a permission. A dash means a regular file, d means a directory, and l means a symbolic link.

Octal notation

Typing out rwx strings is slow, so permissions are usually written as three octal digits. Each permission has a value:

• read = 4
• write = 2
• execute = 1

Add the values for each audience to get its digit. Read plus write plus execute is 4 + 2 + 1 = 7. Read plus execute is 4 + 1 = 5. Read only is 4. Combine the three digits in user, group, other order:

rwx r-x r-x
 7   5   5    ->  755

rw- r-- r--
 6   4   4    ->  644

Common modes and when to use them

644 for regular files

The owner can read and write; everyone else can only read. This is the right default for source code, config files, documents, and web assets that should not be executable.

755 for programs and directories

The owner has full control; group and other can read and execute. Scripts, binaries, and most directories use this so others can run them or enter them without being able to modify them.

600 for secrets

Only the owner can read and write; nobody else sees anything. SSH private keys, token files, and credentials should use 600. Many tools refuse to use a key file that is readable by group or other, precisely because looser permissions leak secrets.

Execute means something different on directories

On a file, execute means run it. On a directory, execute means the ability to enter it and access files inside by name. This leads to a common surprise: a directory with read but no execute lets you list the names of its entries but not actually open them. If you can see a filename yet get permission denied when you open it, a missing execute bit on the directory is a likely cause.

umask sets the defaults

New files do not appear with wide-open permissions by accident. The umask value subtracts permissions from a base. Files start from 666 and directories from 777, then the umask bits are removed. A typical umask of 022 turns new files into 644 and new directories into 755, which matches the sensible defaults above.

umask        # show current value, e.g. 0022
umask 077    # new files 600, new dirs 700 (private)

Setting a tighter umask like 077 is a good habit on shared or server machines, because it makes everything you create private by default.

Why 777 is a mistake

When something does not work, searching the web often turns up the advice to run chmod 777. It usually makes the error disappear, which is exactly why it is dangerous. Mode 777 grants read, write, and execute to every account on the system, so any user or compromised process can overwrite the file, replace a script with their own code, or plant malware. The error went away because you removed the lock, not because you fixed the door.

The correct fix is almost always a specific, minimal permission: give the owning user write access, or adjust group membership, rather than opening the file to the entire machine. When you need to figure out the right octal value for a given combination, the chmod Calculator converts between rwx and octal both ways so you can set exactly the access you intend.

The habit worth keeping

Grant the least access that still lets the task work. Read when reading is enough, write only where changes belong, and execute only on things meant to run. Permissions are not bureaucracy; they are the boundary that keeps a small mistake from becoming a system-wide one.